The optional Verify Clause allows you to invoke a method to check the value in the field. You can compare it with a constant or with the content of another field, validate it as a CRC or checksum or, with a custom method, check it in any other way you might need. In all cases (with standard methods, at least) the test can be reversed by including a NOT (as in an IF clause). The format of the clause is:
VERIFY|SUPPRESS_IF_VERIFIED [NOT] VerifyMethod [ALSO [NOT] VerifyMethod]
The clause is usually introduced by the keyword VERIFY followed by a call to a Verify Method with an optional NOT in between. A Verify Method not only performs a check but, if the check fails, also generates some text indicating what the result of the check should be; this message is then displayed in the Decode Pane. In addition, when the check fails, the entire field is displayed in the Errors section of the Decode Pane and in red instead of the usual black.
You may add a second check to a Verify Clause by following the basic part with the keyword ALSO and a second call to a Verify Method with an optional NOT.
An alternative form of the Verify Clause is introduced by SUPPRESS_IF_VERIFIED. When this keyword is used, everything is done as described above except that the field is displayed only if the check fails (and then of course in red). This is useful for dealing with fields that "should" always contain a certain fixed value.
An example from the IP decoder shows a check that the protocol version number is at least 4:
FIELD version (Fixed 4 Bits) (TABLE ver_nums) "Version" VERIFY (FieldIs GreaterThanOrEqualTo 4)
Another extract from the IP decoder gives an example of using two verification checks:
FIELD ihl (Fixed 4 Bits) (Decimal) IN_SUMMARY IHL 30 "Header Length" VERIFY (FieldIs GreaterThanOrEqualTo 5 ) ALSO (IsNoMoreThanLayerInDwords)
Here a length field is checked both for a minimum value (5) and for consistency with the layer length.
Also, an example taken from the Ethernet decoder illustrates the use of a Verify Method to check a CRC. ("FCS" stands for Frame Check Sequence.)
FIELD fcs START_BIT (FromEnd 4) (Fixed 4) (Hex) FCS NO_MOVE VERIFY (Check_CrcCRC32 0 0xFFFFFFFF Swap)